Detailed description of the invention
For making the purpose of the application, technical scheme and advantage clearer, specifically real below in conjunction with the application
Execute example and technical scheme is clearly and completely described by corresponding accompanying drawing.Obviously, described
Embodiment is only some embodiments of the present application rather than whole embodiments.Based on the enforcement in the application
Example, the every other enforcement that those of ordinary skill in the art are obtained under not making creative work premise
Example, broadly falls into the scope of the application protection.
The process of the method for the identification risk behavior that Fig. 1 provides for the embodiment of the present application, comprises the steps:
S11: obtain the behavioral data of user.
In the embodiment of the present application, behavioral data is obtained by network monitoring system, and network monitoring is by net
Computer in network monitors and controls, with the interconnection each user in network made on time dimension
Net movable (network behavior) carries out record.Wherein, network monitoring system includes monitoring hardware or monitoring software,
Network includes LAN or Metropolitan Area Network (MAN) or wide area network.Above behavioral data is stored in specific storage medium
In, according to actual analysis demand, from described storage medium, it is drawn into corresponding behavioral data is analyzed.
The technical scheme of the application will be introduced herein as a example by certain electricity business website.Then this identification risk behavior
Whether method has risk for the network behavior monitoring the contact staff of certain electricity business website.
S12: choose specific behavior link in subordinate act data.Behavior link refers to that multiple behavior is according to generation
The combination of time order and function sequence gained, owing to behavior link is intended to closer to the real behavior of user, thus carries
Rise the validity of network behavior risk identification.
The method of the identification risk behavior that Fig. 2 provides for the embodiment of the present application is chosen specific in subordinate act data
The process of behavior link, in the embodiment of the present application, step S12 specifically includes following steps:
S121: choose the fragment data in special time period in subordinate act data.
Continue to use present example, it is assumed that needing the network individuality making behaviorist risk analysis is user M, then can be from
Storage medium extracts the fragment data of this user M special time period in some day D, false
If this special time period is 15 minutes, such as: 13:10~13:25, the most described fragment data refers to this user
The M behavioral data that 13:10~13:25 is made in during this period of time in this day.
S122: obtain each behavior included in fragment data.
In the above example, it is assumed that in this sky 13:10~13:25 during this period of time in, the row that user M is made
For including behavior X, behavior Y and behavior Z.
S123: each behavior be ranked up according to the sequencing of time of origin, to obtain behavior link.
In the above example, according to order after arriving first of the time of origin of behavior X, behavior Y and behavior Z
Be ranked up, then the specific behavior link G obtained is: behavior X → behavior Y → behavior Z.
S13: determine specific behavior link risk factor in behavioral data.
In the embodiment of the present application, risk factor is the rare degree for expressing certain specific behavior link G
Numerical value.Generally, if the probability that certain network behavior is occurred is higher, the most universal, then show this network
Behavior is normal behaviour, such as: contact staff checks the behavior of retail shop's information;If certain network behavior is sent out
The probability sent is relatively low, i.e. just can occur in the rarest situation, then show that this network behavior is risk behavior,
Such as: contact staff inquires about the behavior of the consumer record of kith and kin.The application differentiates certain by risk factor
Whether network behavior has risk.
In the embodiment of the present application, above risk factor include short term risk coefficient a, historical risk coefficient b,
One or more in team risk coefficient c.Certainly, in other embodiments of the application, the wind analyzed
Danger coefficient can be not limited to three of the above.Short term risk coefficient a refers to that user M is in first time period t1(such as:
One day) the interior rare degree operating above specific behavior link G;Historical risk coefficient b refers to user M
In total time length t that this user registers2In (interval of hour of log-on to current time) more than operation specific
The rare degree of behavior link G;If the user crowd at definition user M place is user's group, then this user
Group includes multiple user, then to refer to that the user at user M place organizes operation above the most specific for team risk coefficient c
The rare degree of behavior link G.
Hereinafter will be described in detail the determination process of above each risk factor:
The method of the identification risk behavior that Fig. 3 provides for the embodiment of the present application determines the mistake of short term risk coefficient
Journey, specifically includes following steps:
S131: obtain user M in first time period t1The operation total degree s of interior operation all behaviors link1。
Continue to use present example, it is assumed that first time period t1It it is one day, then based on this user M in this day
Behavioral data, the number that can count all behavior links that this user M was made in this day (is i.e. grasped
Make total degree s1).In the embodiment of the present application, it is spaced t with single specific behavior link G durationG
On the basis of, carry out counting user M operation total degree s in this day1, specifically, it is assumed that tGIt is 15 minutes,
Then operation total degree s1=24*60/15=96.
S132: obtain user M in first time period t1The number of operations s of interior operation specific behavior link G2。
In the above example, set first time period t1Be one day, then counting user M is in this sky
Number of times (the i.e. number of operations s of operation specific behavior link G2), specifically, it is assumed that tGIt is 15 minutes,
Then this day is divided into several time slices of 15 minutes, and judges the timeslice of each 15 minutes successively
Generation specific behavior link G, if there being generation, then number of operations s whether is had in Duan2Add 1, if not occurring,
Then number of operations s2Add 0, until the number of operations s obtained in this day2。
S133: determine operation total degree s1With number of operations s2Ratio, to obtain short term risk coefficient a.
In the embodiment of the present application, the formula calculating short term risk coefficient a is as follows:
A=s1/s2。
The method of the identification risk behavior that Fig. 4 provides for the embodiment of the present application determines the mistake of historical risk coefficient
Journey, specifically includes following steps:
S134: obtain user M from hour of log-on t0To current time taTotal time length t2。
Continue to use present example, it is assumed that user M hour of log-on t in the customer service system of certain electricity business website0It is:
On January 1st, 2014, current time taOn January 1st, 2015, then total time length t2It is: 365
My god.
S135: obtain length t actual time of user M operation specific behavior link G3。
In the embodiment of the present application, obtain length t actual time of user M operation specific behavior link G3's
Step to calculate over sky, then by this user M at the behavioral data of above 365 days, daily splits into 365
Individual fragment data, and judge successively whether the fragment data in each sky has specific behavior link G occurred, if
There is generation, then by length t actual time3Add 1, if not occurring, then by length t actual time3Add 0,
Until obtaining actual natural law (i.e. length t actual time of user M operation specific behavior link G3)。
S136: according to total time length t2And length t actual time3, determine historical risk coefficient b.
In the embodiment of the present application, for certain old user, because of its hour of log-on relatively early, total time length
t2Longer (such as: 3 years), it is assumed that this old user operates length t actual time of specific behavior link G3It is 2
My god, the most finally show that this old user is in total time length t2Inside operated the probability of this specific behavior link G relatively
Low;But, for certain new user, because its hour of log-on is later, total time length t2Shorter (such as:
5 days), it is assumed that length t actual time of this new user operation specific behavior link G3It it is 2 days, the most finally
Show that this new user is in total time length t2The probability inside operating this specific behavior link G is higher.It is visible,
Difference between old and new users can affect the really degree of historical risk coefficient b, in order to smoothing processing the old and new use
Difference between family, above step S136 specifically includes:
First, by total time length t2And length t actual time3Make smoothing processing, to obtain smooth total time
Length t2kWith length t smooth actual time3k.In the embodiment of the present application, the mode of smoothing processing can be logarithm
Change processes or remainderization process or evolution process etc..As a example by logarithmetics processing mode, t2k=lg t2;
t3k=lg t3, certainly, the truth of a matter that logarithmetics processes is unrestricted.
Then, by length t smooth actual time2kAnd smooth total time length t3kCarry out computing, to obtain
State historical risk coefficient b.In the embodiment of the present application, the formula calculating historical risk coefficient b is as follows:
B=(1+t3k)/(1+t2k)=(1+lgt3)/(1+lgt2)。
The method of the identification risk behavior that Fig. 5 provides for the embodiment of the present application determines the mistake of team risk coefficient
Journey, specifically includes following steps:
S137: determine total number of users n comprised in user's group at user M place.
Continue to use present example, it is assumed that user M is the contact staff of certain electricity business website, then with this user M institute
It is user's group in department, it is assumed that total number of users n that this department comprises is 20 people.
S138: in described user's group, obtains in the second time period t4Inside operated specific behavior link G's
Actual user number m.
In the above example, it is assumed that the second time period t4Be one day, then this step S138 is used for adding up this use
In 20 people of family M department, certain day operated number (the i.e. actual use of specific behavior link G
Amount m).Specifically, obtain in this department that 20 people are at the behavioral data of this day, the most respectively
Check whether above 20 users operated specific behavior link G, if having, then by reality in this sky
Number of users m adds 1, if not having, then adds 0 by actual user number m, until obtaining operating spy in this sky
Determine the actual user number m of behavior link G.
S139: according to total number of users n and actual user number m, determine team risk coefficient c.
In the embodiment of the present application, if the number of users that user's group of required analysis is comprised is relatively big (such as: n=1000
People), if obtaining operating the actual user number m=5 of specific behavior link G in certain day, show the most this moment
The probability that specific behavior link G was operated in above user's group is relatively low;But, if the use of required analysis
The number of users that family group is comprised is less (such as: n=10 people), if obtaining operating specific behavior in certain sky
The actual user number m=5 of link G, shows that specific behavior link G is grasped in above user's group the most this moment
The probability made is higher.Visible, between different user groups, the difference of number of users can affect team risk coefficient
The really degree of c, for the difference of the number of users that smoothing processing user group is comprised, above step S139
Specifically include:
First, total number of users n and actual user number m are made smoothing processing, to obtain smooth total number of users p
With smooth actual user number q.In the embodiment of the present application, the mode of smoothing processing can be logarithmetics process or
Remainderization process or evolution process etc..As a example by logarithmetics processing mode, p=lg n;Q=lg m, when
So, the truth of a matter that logarithmetics processes is unrestricted.
Then, smooth total number of users p and smooth actual user number q are carried out computing, to obtain described team
Risk factor c.In the embodiment of the present application, the formula calculating team risk coefficient c is as follows:
C=(1+p)/(1+q)=(1+lgn)/(1+lgm).
S14: according to risk factor r, it is determined that whether specific behavior link G has risk.
In the embodiment of the present application, the formula of calculation risk coefficient r is as follows:
R=a × b × c.
Certainly, in other embodiments of the application, risk factor r=a+b+c.
Whether the method for the identification risk behavior that Fig. 6 provides for the embodiment of the present application judges specific behavior link
There is the process of risk.In the embodiment of the present application, above step S14 specifically includes:
S141: by the risk factor r of each behavior link according to being ranked up from high to low.
Continue to continue to use present example, it is assumed that the behavioral data extracted is user M owning at D some day
Behavior link, in this behavioral data, the behavior link monitored has 100, the most respectively according to top
Method determines the risk factor r of these 100 behavior links1~r100, afterwards by risk factor r1~r100According to from height
It is ranked up to low.
S142: judge the risk factor r corresponding to specific behavior link GGWhether it is in risk ranking.
In the embodiment of the present application, the ranking of risk factor is the most forward, then show that behavior link is the rarest, its
Risk factor is the highest, it is assumed that risk ranking set in advance is first 3, then judge specific behavior link G institute
Corresponding risk factor rGWhether it is in first 3.
S143: the most then judge that this specific behavior link G has risk.
If the risk factor r corresponding to specific behavior link GGIt is in first 3, then shows this particular row
For link G, there is risk, this specific behavior link G can be announced as risk behavior afterwards, with
Inform that the contact staff of certain electricity business website does not operate behavior link.
S144: if it is not, then judge that this specific behavior link G does not have risk.
If the risk factor r corresponding to specific behavior link GGIt is not in first 3, then shows that this is specific
Behavior link G does not have risk.
The structural representation of the device of the identification risk behavior that Fig. 7 provides for the embodiment of the present application.Based on equally
Thinking, this device includes:
Acquisition module 10, for obtaining the behavioral data of user.
Choose module 20, for choosing specific behavior link from described behavioral data.
Determine module 30, for determining specific behavior link risk factor in described behavioral data.
According to described risk factor, determination module 40, for judging whether described specific behavior link has wind
Danger.
In the embodiment of the present application, choose module 20 specifically for:
Subordinate act data are chosen the fragment data in special time period.
Obtain each behavior included in fragment data.
Each behavior is ranked up according to the sequencing of time of origin, to obtain specific behavior link.
In the embodiment of the present application, risk factor includes short term risk coefficient, historical risk coefficient, team risk
One or more in coefficient.
In the embodiment of the present application, determine that module 30 includes that short term risk determines module 31, be used for:
Obtain user in first time period, operate the operation total degree of all behavior links.
Obtain user in first time period, operate the number of operations of specific behavior link.
Determine the ratio of operation total degree and number of operations, to obtain short term risk coefficient.
In the embodiment of the present application, determine that module 30 includes that historical risk determines module 32, be used for:
Obtain user's total time length from hour of log-on to current time.
Obtain length actual time of user operation specific behavior link.
According to total time length and length actual time, determine historical risk coefficient.
In the embodiment of the present application, determine that module 30 includes that team risk determines module 33, be used for:
Determine the total number of users comprised in user's group at user place.
In user's group, obtain the actual user's number operating specific behavior link within the second time period.
According to total number of users and actual user's number, determine team risk coefficient.
In the embodiment of the present application, historical risk determines that module 32 includes the first smoothing processing unit, is used for:
Total time length and length actual time are made smoothing processing, to obtain smoothing total time length and smoothing
Actual time length.
Length smooth actual time and smooth total time length are carried out computing, to obtain historical risk coefficient.
In the embodiment of the present application, team risk determines that module 33 includes the second smoothing processing unit, is used for:
Total number of users and actual user's number are made smoothing processing, to obtain smooth total number of users and smooth reality use
Amount.
Smooth total number of users and smooth actual user's number are carried out computing, to obtain team risk coefficient.
In the embodiment of the present application, determine module 30 specifically for: by short term risk coefficient, historical risk system
Number and team risk coefficient carry out product or summation, to obtain described risk factor.
In the embodiment of the present application, it is determined that module 40 specifically for:
By the risk factor of each behavior link according to being ranked up from high to low.
Judge whether the risk factor corresponding to specific behavior link is in risk ranking.
The most then judge that this specific behavior link has risk, if it is not, then judge this specific behavior link not
There is risk.
The method and device that the embodiment of the present application is provided, by obtaining the behavioral data of user, and from this row
For data are chosen specific behavior link, determine that described specific behavior link is at described behavior number by computing
Finally according to risk factor, risk factor according to, determines whether specific behavior link has risk.Above
Process is compared to regulation engine mode, it is not necessary to manually fills up rule leak, thus improves behaviorist risk identification
Efficiency;Additionally, above procedure avoids regulation engine consumes the drawback of extra computer resource, thus
Alleviate the burden of computer system.
The embodiment of the present application considers short-term (such as: certain sky), history (hour of log-on is to current time)
And team's (user place user's group) these three factor, whether the behavior analyzing user has risk,
Thus reduce the transformation (such as: team adjusts traffic direction or user and transfers) of some burst factor to
The impact of the behavior link at family, and then promote accuracy and the validity of risk Activity recognition.
It is noted that the device of identification risk behavior described herein is based on risk row identified above
For method, produced by same thinking, therefore the method for this identification risk behavior can continue to use above knowledge
All technical characteristics of the device of other risk behavior, are the most no longer repeated.
It is otherwise noted that the computing formula of each risk factor is not limited to disclosed reality in the application
Execute example, such as: in other embodiments, short term risk coefficient a=s2/s1;Historical risk coefficient
B=(1+lgt2)/(1+lgt3);Team risk coefficient c=(1+lgm)/(1+lgn).Correspondingly, row is judged follow-up
When whether there is risk for link, then by the risk factor of each behavior link according to arranging from low to high
Sequence, to judge whether the risk factor corresponding to specific behavior link is in risk ranking.
Those skilled in the art are it should be appreciated that embodiments of the invention can be provided as method, system or meter
Calculation machine program product.Therefore, the present invention can use complete hardware embodiment, complete software implementation or knot
The form of the embodiment in terms of conjunction software and hardware.And, the present invention can use and wherein wrap one or more
Computer-usable storage medium containing computer usable program code (include but not limited to disk memory,
CD-ROM, optical memory etc.) form of the upper computer program implemented.
The present invention is with reference to method, equipment (system) and computer program product according to embodiments of the present invention
The flow chart of product and/or block diagram describe.It should be understood that can by computer program instructions flowchart and
/ or block diagram in each flow process and/or flow process in square frame and flow chart and/or block diagram and/
Or the combination of square frame.These computer program instructions can be provided to general purpose computer, special-purpose computer, embedding
The processor of formula datatron or other programmable data processing device is to produce a machine so that by calculating
The instruction that the processor of machine or other programmable data processing device performs produces in order to realize at flow chart one
The device of the function specified in individual flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.
These computer program instructions may be alternatively stored in and computer or the process of other programmable datas can be guided to set
In the standby computer-readable memory worked in a specific way so that be stored in this computer-readable memory
Instruction produce and include the manufacture of command device, this command device realizes in one flow process or multiple of flow chart
The function specified in flow process and/or one square frame of block diagram or multiple square frame.
These computer program instructions also can be loaded in computer or other programmable data processing device, makes
Sequence of operations step must be performed to produce computer implemented place on computer or other programmable devices
Reason, thus the instruction performed on computer or other programmable devices provides in order to realize flow chart one
The step of the function specified in flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.
In a typical configuration, calculating equipment includes one or more processor (CPU), input/defeated
Outgoing interface, network interface and internal memory.
Internal memory potentially includes the volatile memory in computer-readable medium, random access memory
(RAM) and/or the form such as Nonvolatile memory, such as read only memory (ROM) or flash memory (flash RAM).
Internal memory is the example of computer-readable medium.
Computer-readable medium includes that removable media permanent and non-permanent, removable and non-can be by appointing
Where method or technology realize information storage.Information can be computer-readable instruction, data structure, program
Module or other data.The example of the storage medium of computer includes, but are not limited to phase transition internal memory
(PRAM), static RAM (SRAM), dynamic random access memory (DRAM), its
The random access memory (RAM) of his type, read only memory (ROM), electrically erasable are read-only
Memorizer (EEPROM), fast flash memory bank or other memory techniques, read-only optical disc read only memory
(CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tape, tape magnetic
Disk storage or other magnetic storage apparatus or any other non-transmission medium, may be used to storage can be calculated
The information that equipment accesses.According to defining herein, computer-readable medium does not include temporary computer-readable matchmaker
Body (transitory media), such as data signal and the carrier wave of modulation.
Also, it should be noted term " includes ", " comprising " or its any other variant are intended to non-row
Comprising, so that include that the process of a series of key element, method, commodity or equipment not only include of his property
Those key elements, but also include other key elements being not expressly set out, or also include for this process,
The key element that method, commodity or equipment are intrinsic.In the case of there is no more restriction, statement " include
One ... " key element that limits, it is not excluded that including the process of described key element, method, commodity or setting
Other identical element is there is also in Bei.
It will be understood by those skilled in the art that embodiments herein can be provided as method, system or computer journey
Sequence product.Therefore, the application can use complete hardware embodiment, complete software implementation or combine software and
The form of the embodiment of hardware aspect.And, the application can use and wherein include calculating one or more
The computer-usable storage medium of machine usable program code (include but not limited to disk memory, CD-ROM,
Optical memory etc.) form of the upper computer program implemented.
The foregoing is only embodiments herein, not in order to limit the application.For this area skill
For art personnel, the application can have various modifications and variations.All institutes within spirit herein and principle
Any modification, equivalent substitution and improvement etc. made, within the scope of should be included in claims hereof.